Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Visual Studio Code-delivered JavaScript backdoor

Malware Activity
First reported
Last updated
Happening score
H score 29
1 unique sources, 2 articles

Summary

Hide ▲

Jamf Threat Labs said North Korean threat actors behind Contagious Interview are using a new Visual Studio Code delivery path that lures developers into opening malicious GitHub or GitLab repositories, trusting the author, and then runs a malicious configuration file that can execute arbitrary commands and drop a previously unseen JavaScript backdoor via Node.js on macOS. The campaign has been active since late 2023 and has been tied to credential theft and other sensitive data collection. Microsoft later reported malicious Next.js repositories disguised as technical assessment materials in fake job-recruitment lures. That activity can trigger remote code execution (RCE), establish persistent command-and-control (C2), and expose source code, secrets, and build or cloud resources.

Related Happenings

Codfish/semantic-release-action hit by network compromise

Incident
H score21 First: 26.06.2026 14:05 Last: 26.06.2026 14:05 Sources 1

About this happening: The codfish/semantic-release-action GitHub Action was hit by a malicious commit force-push and tag redirection that caused trusted workflows to run attacker code. The...

Open Happening

Microsoft AutoGen Studio AutoJack MCP WebSocket command execution security flaw

Vulnerability
H score33 First: 22.06.2026 20:28 Last: 22.06.2026 20:28 Sources 1

About this happening: Microsoft’s AutoJack chain exposed AutoGen Studio to arbitrary command execution for developers building from the main GitHub branch before the hardening commit.

Open Happening

Contagious Interview UNK_DeadDrop GitHub phishing campaign

Campaign
H score37 First: 15.06.2026 22:32 Last: 15.06.2026 22:32 Sources 1

About this happening: The Contagious Interview cluster is running the UNK_DeadDrop phishing campaign to lure developers with recruitment and code review themes, reaching nearly 100 or...

Open Happening

UNK_DeadDrop developer phishing campaign using fake job and code-review lures

Campaign
H score30 First: 08.06.2026 18:00 Last: 08.06.2026 18:00 Sources 1

About this happening: A UNK_DeadDrop phishing campaign sent more than 250 emails to software developers at almost 100 organizations, using fake job and code-review lures to steal cryptocu...

Open Happening

Visual Studio Code VS Code token-theft zero-day security flaw

Vulnerability
H score44 First: 03.06.2026 09:50 Last: 03.06.2026 09:50 Sources 1

About this happening: A Visual Studio Code (VS Code) zero-day lets attackers steal GitHub OAuth tokens by abusing the editor's sandboxed webview message-passing system. The flaw is especial...

Latest development: 03.06.2026 15:58

Microsoft has acknowledged a Visual Studio Code vulnerability that can let an attacker use a crafted link and malicious webview message-passing to steal a victim's GitHub OAuth token via GitHub.dev, and said it is working on a fix; Microsoft also said the issue does not affect VS Code Desktop.

Open Happening

Timeline

  1. 22.01.2026 00:00 3 articles · 5mo ago

    Contagious Interview adds VS Code backdoor delivery

    Initial Disclosure

    Jamf Threat Labs disclosed that North Korean threat actors behind the Contagious Interview campaign are using a new Visual Studio Code delivery path that lures software developers to open malicious GitHub or GitLab repositories, prompts them to trust the repository author, and then executes a malicious configuration file that can run arbitrary commands and drop a previously unseen JavaScript backdoor via Node.js on macOS systems.

    Show sources
    Open in new tab